smb: client: fix potential UAF in cifs_stats_proc_write()

Paulo Alcantara · smfrench · commit d3da25c5ac84 · 2024-04-03T14:43:45.000-05:00
Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.

Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (Red Hat) &lt;pc@manguebit.com&gt;
Signed-off-by: Steve French &lt;stfrench@microsoft.com&gt;
diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
@@ -678,6 +678,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,
 			}
 #endif /* CONFIG_CIFS_STATS2 */
 			list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
+				if (cifs_ses_exiting(ses))
+					continue;
 				list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 					atomic_set(&tcon->num_smbs_sent, 0);
 					spin_lock(&tcon->stat_lock);

Original file line number	Diff line number	Diff line change
`@@ -678,6 +678,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,`
`678`	`678`	`}`
`679`	`679`	`#endif /* CONFIG_CIFS_STATS2 */`
`680`	`680`	`list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {`
	`681`	`+ if (cifs_ses_exiting(ses))`
	`682`	`+ continue;`
`681`	`683`	`list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {`
`682`	`684`	`atomic_set(&tcon->num_smbs_sent, 0);`
`683`	`685`	`spin_lock(&tcon->stat_lock);`